NVD

Id
9283  
Name
CVE-2011-2507  
Description
libraries/server_synchronize.lib.php in the Synchronize implementation in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1 does not properly quote regular expressions, which allows remote authenticated users to inject a PCRE e (aka PREG_REPLACE_EVAL) modifier, and consequently execute arbitrary PHP code, by leveraging the ability to modify the SESSION superglobal array.  
Reject
 
CVSS Version
2  
CVSS Score
6.5  
Severity
Medium  
CVSS Base Score
6.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
8  
CVSS Vector
(AV:N/AC:L/Au:S/C:P/I:P/A:P)  
Pub Date
2017-01-07  
Published
2011-07-14  
Modified Date
2011-10-25  
Seq
2011-2507  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
53093 9283 CVE-2011-2507 http://ha.xxor.se/2011/07/phpmyadmin-3x-multiple-remote-code.html  View
53094 9283 CVE-2011-2507 http://ha.xxor.se/2011/07/phpmyadmin-3x-pregreplace-rce-poc.html  View
53095 9283 CVE-2011-2507 FEDORA-2011-9144  View
53096 9283 CVE-2011-2507 http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin;a=commit;h=69fb0f8e7dc38075427aceaf09bcac697d0590ff  View
53097 9283 CVE-2011-2507 8306  View
53098 9283 CVE-2011-2507 http://typo3.org/teams/security/security-bulletins/typo3-sa-2011-008/  View
53099 9283 CVE-2011-2507 DSA-2286  View
53100 9283 CVE-2011-2507 MDVSA-2011:124  View
53101 9283 CVE-2011-2507 [oss-security] 20110628 CVE Request: phpMyAdmin 3.4 Multiple Vulnerabilities  View
53102 9283 CVE-2011-2507 [oss-security] 20110628 Re: CVE Request: phpMyAdmin 3.4 Multiple Vulnerabilities  View
53103 9283 CVE-2011-2507 [oss-security] 20110628 Re: [Phpmyadmin-security] CVE Request: phpMyAdmin 3.4 Multiple Vulnerabilities  View
53104 9283 CVE-2011-2507 [oss-security] 20110629 Re: CVE Request: phpMyAdmin 3.4 Multiple Vulnerabilities  View
53105 9283 CVE-2011-2507 http://www.phpmyadmin.net/home_page/security/PMASA-2011-7.php  View
53106 9283 CVE-2011-2507 20110707 phpMyAdmin 3.x Multiple Remote Code Executions  View
53107 9283 CVE-2011-2507 http://www.xxor.se/advisories/phpMyAdmin_3.x_Multiple_Remote_Code_Executions.txt  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
34481 JVNDB-2011-004723 phpMyAdmin の libraries/server_synchronize.lib.php における PCRE e 修飾子を挿入される脆弱性 phpMyAdmin の Synchronize 実装の libraries/server_synchronize.lib.php は、正規表現を適切に引用しないため、PCRE e 修飾子を挿入され、その結果任意の PHP コードを実行される脆弱性が存在します。 CVE-2011-2507 50414 CVE-2011-2507 9283 6.5 http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-004723.html 2011-07-02 2012-03-27 View